Securing .NET Compact Framework Solutions

In recent times, and with good reason - as attacks by worms
such as Code Red, Nimbda, and Slammer have shown - security has been
pushed to the forefront of the minds of architects and developers.
And just as Microsoft has rededicated itself to security through its
Trustworthy Computing Initiative, your organization should be sure to
design and implement its applications using secure coding practices
and principles. Even though .NET Compact Framework applications may
at first appear immune to such attacks, their connection to back-end
systems and their portability introduce a variety of security risks
that must be mitigated.

CIO, CTO & Developer Resources

In this column we'll review what you'll need to consider to
implement security at the device, application, and communication
layers.

Secure the Device
The first layer of security to consider is that provided by
the device itself. In addition to relying on mechanisms provided by
the device manufacturer or platform (such as the Pocket PC running on
Windows CE), your organization can augment the OS software with
third-party solutions. Generally, the types of security that can be
used to protect the device fall into the categories of
authentication, antivirus protection, and lockdown.

Authentication: The simplest step organizations can take to protect devices on which Compact Framework applications run is to
require some form of authentication. For example, Pocket PC 2002 and
later devices running Windows CE support both simple and strong
power-on password authentication. By enabling this feature on the
device, the user must type in a simple four-character, or more
complex seven-character, password at a configurable interval that
defaults to one hour. If a user enters an incorrect password, an
exponentially increasing time delay is enforced, making it very
difficult to repeatedly guess the password. Third-party vendors, such
as Trust Digital LLC through its PDASecure product, provide power-on
password authentication with additional options that include locking
the device after a certain number of invalid password attempts and
additionally requiring a soft reset, hard reset, or even "wiping" the
device of its data.

Although this form of authentication can be quite
effective, it is based on knowledge of a password that can perhaps be
obtained through illegitimate means. To implement authentication
based on possession of a physical item like a smart card or a
cryptographic certificate located on a removable storage card, or
based on user identity through biometric (e.g., fingerprint) or
signature identification, third-party products are required. Vendors
such as A2000 Distribution, Certicom Corporation, and Cloakware
Corporation provide a variety of such solutions.

Antivirus Protection: Even though viruses that target mobile devices are not as prevalent as those targeting desktop computers,
they are still a potential threat to any software on the device.
Typically, however, devices are not damaged by viruses but rather
pass them into a corporate network via e-mail attachments and
documents. There are, as you might expect, a variety of antivirus
packages on the market for devices such as the Pocket PC, from
vendors including McAfee, Computer Associates, and F-Secure.
Additionally, personal firewall products such as VPN-1 are available
from vendors such as Check Point Software Technologies Ltd.

Lockdown: Following the accepted security principle of
"reducing the attack surface," many organizations may wish to disable
some features of the device. Third-party software such as PDASecure,
for example, does just that by password protecting or disabling
infrared communications, ActiveSync, and the voice recorder.

Secure the Application
The second layer to which security should be applied is the
application itself. Typically, such security includes the concepts of
authentication, data protection, and user input.

Authentication: Of course, the main way to secure an
application on the device is by requiring the user to present
credentials in order to be authenticated by the application. However,
depending on what data source the application uses and how it creates
a connection, this process can vary greatly. For example, a Compact
Framework application might need to authenticate directly to SQL
Server when using the SQLClient .NET Data Provider, to a Web server
and SQL Server when using Remote Data Access or replication with SQL
Server 2000 Windows CE Edition (SSCE), through a SOAP request when
using an XML Web service, or through HTTP when using the HTTP
pluggable protocol.

In each of these cases your application must manage the
credentials. In the case where multiple sets of credentials are
required (for example, for a proxy and Web server in addition to SQL
Server) it is a good practice to store the credentials in an
encrypted database or file on the device or even on a storage card
that is required to be inserted before the application can run.

Data protection: This concept involves two key aspects.
First, any local data used by the application must be secured. This
can be most easily accomplished using the built-in encryption feature
of SSCE, which encrypts the database using the RC4 symmetric
encryption algorithm with a key generated from an MD5 hash of the
password (which implies that the strength of the encryption is
dependent on the length of the password chosen). However, if local
data is stored in a file it will need to be encrypted using the
CryptoAPI (which supports 128-bit encryption on Pocket PC 2002 and
Pocket PC 2000 with the Microsoft High Encryption Pack installed)
since the System.Security. Cryptography namespace is not supported in
the Compact Framework. Additionally, third-party encryption tools
such as PDASecure support encryption of individual files.

User input: As codified in the "Don't Trust User Input"
security principle, you need to secure user input. This issue is most
directly relevant when accepting user input that is subsequently used
to query or update data in SSCE or on a remote SQL Server. Malicious
users may attempt to insert or inject additional SQL into a TextBox
control, thereby causing a possibly harmful statement to run against
the database. Such SQL injection attacks can be mitigated by
cleansing user input with a function. In general, user input can be
checked using regular expressions through the RegEx class of the
System.Text.RegularExpressions namespace. One interesting use of this
class is to create a derived TextBox control that uses a regular
expression to validate the text entered by the user.

Secure the Channel
The final aspect to securing an application involves securing
the transmission of data across the network. This aspect can involve
a wide range of issues, including the use of Secure Sockets Layer
(SSL), Virtual Private Networks (VPNs), and Wired Equivalent Privacy
(WEP).

Secure Sockets Layer: The most fundamental way to secure the communication channel between a device and network is the use of SSL
over HTTP. Simply put, SSL uses public- and private-key encryption
based on the RSA algorithm, along with the use of a digital
certificate to encrypt all of the communication between a client and
a server. Fortunately, support for 128-bit SSL is built into both
Pocket PC 2002 and 2000 devices (with the Microsoft High Encryption
Pack installed). Since SSL is used over HTTP, Compact Framework
applications can use it when connecting to a back-end server using
SSCE connectivity, XML Web services, or the HTTP pluggable
protocol.

On the server side, the IIS server must have a digital
certificate installed for the virtual directory in which the resource
(the HTML page, for example) resides. The certificate may be either
one obtained from a trusted certificate authority such as VeriSign or
one generated internally within the organization using Microsoft
Certificate Server. In the latter case the root certificate for your
organization must also be installed on the device.

Virtual private networks: A second option for encrypting the communication channel is the use of VPNs that rely on protocols such as the Point-to-Point Tunneling Protocol (PPTP) and the IP security protocol (IPSec) to both
authenticate and encrypt communications. While Pocket PC 2002 and
Windows CE .NET 4.1 devices do not support IPSec, they do support
PPTP when setting up connections in the Connections tab of the device
Settings. After entering the address of the VPN server for the
connection, the device will prompt the user for credentials when a
connection is made. In order to provide VPN functionality to Pocket
PC 2000 devices or to use IPSec, a number of third-party products are
available from vendors, including Certicom Corporation and Check
Point Software Technologies.

Wired Equivalent Privacy: In wireless networks, unlike in
wired LANs, walls are ineffective as a means of security since radio
waves are not bound by the walls used to
protect the network. A first-generation technology used
to protect such networks was based on the WEP security
protocol. However, this protocol was found to contain flaws that left
it vulnerable to attack. As a result, WEP is considered unsecure and
should not be used without additional security such as VPNs or SSL.

Although an initiative called WEP2 was developed to
address the issues with WEP, many in the industry felt it too was
vulnerable to attack. However, the 802.11i standard, currently in
draft form, addresses many of these security issues. While the new
specification is being ratified, wireless vendors have agreed on an
interim solution called Wi-Fi Protected Access (WPA). WPA support is
currently being rolled out in products such as Funk Software's
Odyssey Client and Meetinghouse
Data Communications' AEGIS Client. In the interim other organizations
using server and client software primarily from Funk and Meetinghouse
have gone forward and implemented the Extensible Authentication
Protocol (EAP) over the competing Tunneled Transport Layer Security
(TTLS) protocol developed by Funk and Certicom and the Protected
Extensible Authentication Protocol (PEAP) developed by Microsoft and
Cisco Systems to allow secure access to WLANs on their corporate
campuses. In addition, third parties such as MobileSys, Inc., and
Altarus Corporation offer wireless encryption technology.

Security Is Key
We hope this column has given you a framework for thinking
about how to secure your .NET Compact Framework applications.

Jon Box is an Architect Evangelist in Developer & Platform Evangelism with the Microsoft Corporation. He coauthored Building Solutions with the Microsoft .NET Compact Framework, published by Addison-Wesley, and blogs at http://blogs.msdn.com/jonbox/default.aspx.

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

Even as cloud and managed services grow increasingly central to business strategy and performance, challenges remain. The biggest sticking point for companies seeking to capitalize on the cloud is data security. Keeping data safe is an issue in any computing environment, and it has been a focus since the earliest days of the cloud revolution. Understandably so: a lot can go wrong when you allow valuable information to live outside the firewall. Recent revelations about government snooping, along with a steady stream of well-publicized data breaches, only add to the uncertainty

SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY.
Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.

The Workspace-as-a-Service (WaaS) market will grow to $6.4B by 2018. In his session at 16th Cloud Expo, Seth Bostock, CEO of IndependenceIT, will begin by walking the audience through the evolution of Workspace as-a-Service, where it is now vs. where it going.
To look beyond the desktop we must understand exactly what WaaS is, who the users are, and where it is going in the future. IT departments, ISVs and service providers must look to workflow and automation capabilities to adapt to growing demand and the rapidly changing workspace model.

Hadoop as a Service (as offered by handful of niche vendors now) is a cloud computing solution that makes medium and large-scale data processing accessible, easy, fast and inexpensive.
In his session at Big Data Expo, Kumar Ramamurthy, Vice President and Chief Technologist, EIM & Big Data, at Virtusa, will discuss how this is achieved by eliminating the operational challenges of running Hadoop, so one can focus on business growth. The fragmented Hadoop distribution world and various PaaS solutions that provide a Hadoop flavor either make choices for customers very flexible in the name of opti...

As organizations shift toward IT-as-a-service models, the need for managing and protecting data residing across physical, virtual, and now cloud environments grows with it. CommVault can ensure protection &E-Discovery of your data – whether in a private cloud, a Service Provider delivered public cloud, or a hybrid cloud environment – across the heterogeneous enterprise.
In his session at 16th Cloud Expo, Randy De Meno, Chief Technologist - Windows Products and Microsoft Partnerships, will discuss how to cut costs, scale easily, and unleash insight with CommVault Simpana software, the only si...

Cloud data governance was previously an avoided function when cloud deployments were relatively small. With the rapid adoption in public cloud – both rogue and sanctioned, it’s not uncommon to find regulated data dumped into public cloud and unprotected. This is why enterprises and cloud providers alike need to embrace a cloud data governance function and map policies, processes and technology controls accordingly.
In her session at 15th Cloud Expo, Evelyn de Souza, Data Privacy and Compliance Strategy Leader at Cisco Systems, will focus on how to set up a cloud data governance program and s...

Roberto Medrano, Executive Vice President at SOA Software, had reached 30,000 page views on his home page - http://RobertoMedrano.SYS-CON.com/ - on the SYS-CON family of online magazines, which includes Cloud Computing Journal, Internet of Things Journal, Big Data Journal, and SOA World Magazine. He is a recognized executive in the information technology fields of SOA, internet security, governance, and compliance. He has extensive experience with both start-ups and large companies, having been involved at the beginning of four IT industries: EDA, Open Systems, Computer Security and now SOA.

The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information.
In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...

Operational Hadoop and the Lambda Architecture for Streaming Data
Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, representing a model of how to analyze rea...

SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY.
Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.

The Internet of Things (IoT) promises to evolve the way the world does business; however, understanding how to apply it to your company can be a mystery. Most people struggle with understanding the potential business uses or tend to get caught up in the technology, resulting in solutions that fail to meet even minimum business goals.
In his session at @ThingsExpo, Jesse Shiah, CEO / President / Co-Founder of AgilePoint Inc., showed what is needed to leverage the IoT to transform your business. He discussed opportunities and challenges ahead for the IoT from a market and technical point of vie...

Advanced Persistent Threats (APTs) are increasing at an unprecedented rate. The threat landscape of today is drastically different than just a few years ago. Attacks are much more organized and sophisticated. They are harder to detect and even harder to anticipate. In the foreseeable future it's going to get a whole lot harder. Everything you know today will change. Keeping up with this changing landscape is already a daunting task. Your organization needs to use the latest tools, methods and expertise to guard against those threats. But will that be enough? In the foreseeable future attacks w...

HP and Aruba Networks on Monday announced a definitive agreement for HP to acquire Aruba, a provider of next-generation network access solutions for the mobile enterprise, for $24.67 per share in cash. The equity value of the transaction is approximately $3.0 billion, and net of cash and debt approximately $2.7 billion. Both companies' boards of directors have approved the deal.
"Enterprises are facing a mobile-first world and are looking for solutions that help them transition legacy investments to the new style of IT," said Meg Whitman, Chairman, President and Chief Executive Officer of HP...

Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.
Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices
Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch of Docker's initial release in March of 2013, interest was revved up several notches. Then late last...

The explosion of connected devices / sensors is creating an ever-expanding set of new and valuable data. In parallel the emerging capability of Big Data technologies to store, access, analyze, and react to this data is producing changes in business models under the umbrella of the Internet of Things (IoT). In particular within the Insurance industry, IoT appears positioned to enable deep changes by altering relationships between insurers, distributors, and the insured.
In his session at @ThingsExpo, Michael Sick, a Senior Manager and Big Data Architect within Ernst and Young's Financial Servi...

The explosion of connected devices / sensors is creating an ever-expanding set of new and valuable data. In parallel the emerging capability of Big Data technologies to store, access, analyze, and react to this data is producing changes in business models under the umbrella of the Internet of Things (IoT). In particular within the Insurance industry, IoT appears positioned to enable deep changes by altering relationships between insurers, distributors, and the insured.
In his session at @ThingsExpo, Michael Sick, a Senior Manager and Big Data Architect within Ernst and Young's Financial Servi...

PubNub on Monday has announced that it is partnering with IBM to bring its sophisticated real-time data streaming and messaging capabilities to Bluemix, IBM’s cloud development platform.
“Today’s app and connected devices require an always-on connection, but building a secure, scalable solution from the ground up is time consuming, resource intensive, and error-prone,” said Todd Greene, CEO of PubNub. “PubNub enables web, mobile and IoT developers building apps on IBM Bluemix to quickly add scalable realtime functionality with minimal effort and cost.”

Sensor-enabled things are becoming more commonplace, precursors to a larger and more complex framework that most consider the ultimate promise of the IoT: things connecting, interacting, sharing, storing, and over time perhaps learning and predicting based on habits, behaviors, location, preferences, purchases and more.
In his session at @ThingsExpo, Tom Wesselman, Director of Communications Ecosystem Architecture at Plantronics, will examine the still nascent IoT as it is coalescing, including what it is today, what it might ultimately be, the role of wearable tech, and technology gaps stil...

With several hundred implementations of IoT-enabled solutions in the past 12 months alone, this session will focus on experience over the art of the possible. Many can only imagine the most advanced telematics platform ever deployed, supporting millions of customers, producing tens of thousands events or GBs per trip, and hundreds of TBs per month.
With the ability to support a billion sensor events per second, over 30PB of warm data for analytics, and hundreds of PBs for an data analytics archive, in his session at @ThingsExpo, Jim Kaskade, Vice President and General Manager, Big Data & Ana...

An anatomy of startup ventures for the Internet of Things market. Like GE describes in their white paper Pushing the Boundaries of Mind and Machine, this is basically a process of innovating through more intelligent machines to reinvent workflow models.
For a useful overview as to what constitutes an ‘IoT startup’, check out one example for some key characteristics: Hutgrip. Hutgrip is a SaaS solution that replaces VPNs with the Cloud and real time analytics, with the headline points being:
Clear description of the business benefit the new technology will bring – Smarter automation of bi...

Trust is the fundamental building block of any relationship. Whether it's personal or business, trust is something that cannot be replaced with anything. There are hundreds of books available on how to cultivate business relationships, how to maintain them, and how to leverage the best from them and so on. What forms the basis of a business relationship and what are the fundamental blocks of building trust? Here are three things that will get you started when thinking about using trust building trust and maintaining trust.

The Internet of Things has emerged as the universally accepted term for the ‘next big thing’ wave, not replacing but building upon the Cloud Computing cycle, which itself built upon SaaS and ASPs.
There are many technology aspects to this trend, which will be covered extensively throughout this guide and ongoing series, but overall our goal is to describe the associated startup venture opportunities.
Indeed it’s not limited to startups, the IoT represents a new product innovation platform for any and all businesses, and this is the overall theme of this paper.

In my first blog I wrote about SharePoint System Performance Health Checks beyond looking at CPU and Memory Metrics. In this blog, I cover deployment related performance health problems that I always check when looking at a SharePoint Installation. Especially after deploying new hardware, new sites, pages, views, custom or third-party Web Parts (e.g., from AvePoint, K2, Nintex, Metalogix, etc.) it’s important to perform certain deployment sanity checks. While you may have nobody reporting issues in the moment there are several areas that you constantly need to check before they become a real p...

Creating global change that is actually good for the entire world is a mammoth task. With a population of almost 7 Billion people as of 2015, the planet is taking a toll with surviving the brunt of keeping the works going. What role can Cloud Computing play in making it easier for all of us?

One important differentiator between what passed for digital back in the dot-com days and today’s notion of digital is the role mobile plays. Yes, this company had a mobile site, and they had what the AVP claimed was a “mobile first” plan for their web content, but as yet they had yet to roll out any responsive design. In the final analysis, their digital effort up to this point boiled down to little more than better brochureware, a la 1990s web redesigns.
But more significantly, what was entirely missing from their digital achievements (although the AVP did indicate that it was a roadmap i...

FedRAMP defines the requirements for cloud service providers’ security controls, including vulnerability scanning, incident monitoring, logging, and reporting. CSPs in use at federal agencies or in acquisition must meet the cloud computing requirements defined by FedRAMP.
Whether or not your company currently works with government agencies, there are several benefits to preparing for FedRAMP.

The challenge facing today’s project management professionals is supporting a more agile approach to software releases while managing orderly governance and production controls that are necessary. Project managers have become air traffic controllers landing more projects more frequently on more runways, and as the skies become more crowded it’s important to understand both the trends and some strategies for managing the increasingly agile enterprise.

Our guest on the podcast this week is Mark Thiele, EVP of Data Center Technology at Switch.
We discuss the idea that private clouds are often equated with do-it-yourself and why that should be changed.
Taking sure you are receiving the private environment you need at a cost that can support your business.
Listen in to learn the different ways to own and manage a private cloud.

It’s easy to fall into a pattern of dysfunctional releases, release processes that are characterized by delay, inefficiency, and endless meetings that encourage people to view releases as a problem. These are the kinds of meetings that inspire references to the movie Office Space or emails that include clippings of the cartoon Dilbert - repetitive meetings to answer the same questions over and over again all because people lack the tools to connect the issue tracker with the change management systems.
In organizations without a reliable process a release is also a time for production system o...

A large US insurance carrier, based in the Midwest, has improved its applications’ lifecycle to make enterprise mobility a must-have business strength.
This five-part series of penetrating discussions on the latest in enterprise mobility explores advancements in applications design and deployment technologies across the full spectrum of edge devices and operating environments.
Our next innovation interview focuses on how a large US insurance carrier, based in the Midwest, has improved its applications’ lifecycle to make enterprise mobility a must-have business strength.

Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.
Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices
Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch of Docker's initial release in March of 2013, interest was revved up several notches. Then late last...

DevOps is all about removing barriers to rapid, safe delivery of new experiences to your customers. Much of this revolves around automating error-prone, human-driven processes so that processes can be standardized, scaled, and varied programmatically. Some of the types of tools used in a DevOps-minded organization might include version control systems, automation servers, and configuration management systems. Many tools can be used across categories, with varying amounts of success. Some vendors offer products that claim to address all of these needs with one solution – most rarely deliver on ...

Application metrics, logs, and business KPIs are a goldmine. It’s easy to get started with the ELK stack (Elasticsearch, Logstash and Kibana) – you can see lots of people coming up with impressive dashboards, in less than a day, with no previous experience. Going from proof-of-concept to production tends to be a bit more difficult, unfortunately, and it tends to gobble up our attention, time, and money.
In his session at DevOps Summit, Otis Gospodnetić, co-author of Lucene in Action and founder of Sematext, will share the architecture and decisions behind Sematext’s services for handling larg...

Over the last couple of years I have talked to numerous enterprise customers, analysts, industry pundits, and others interested in cloud technologies, and one thing is abundantly clear – Platform-as-a-Service (PaaS) seems to mean different things to different people. But the term PaaS is irrelevant – it's just noise. What is relevant, and what is important, is what PaaS does: enable applications. That's what enterprises care about. They want to accelerate application development to get products to market faster and into users' hands sooner.

The competition among public cloud providers is red hot, private cloud continues to grab increasing shares of IT budgets, and hybrid cloud strategies are beginning to conquer the enterprise IT world.

Big Data is driving dramatic leaps in resource requirements and capabilities, and now the Internet of Things promises an exponential leap in the size of the Internet and Worldwide Web.

The world of SDX now encompasses Software-Defined Data Centers (SDDCs) as the technology world prepares for the Zettabyte Age.

Add the key topics of WebRTC and DevOps into the mix, and you have three days of pure cloud computing that you simply cannot miss.

Cloud Expo - the world's most established event - offers a vast selection of 130+ technical and strategic Industry Keynotes, General Sessions, Breakout Sessions, and signature Power Panels. The exhibition floor features 100+ exhibitors offering specific solutions and comprehensive strategies. The floor also features two Demo Theaters that give delegates the opportunity to get even closer to the technology they want to see and the people who offer it.

Attend Cloud Expo. Craft your own custom experience. Learn the latest from the world's best technologists. Find the vendors you want and put them to the test.